Over the last decade, malicious software (malware) has become a pervasive problem for Internet users. In some situations, malware is a program or file that is embedded within downloadable content and designed to adversely influence or attack normal operations of a computer. Examples of different types of malware may include bots, computer viruses, worms, Trojan horses, spyware, adware, callbacks, or any other content that may operate within an electronic device (e.g., laptop computer, desktop computer, tablet computer, smartphone, server, router, wearable technology, or other types of electronics with data processing capabilities) without permission by the user or an administrator. The malware may be directed toward a specific target (premium attack) or may be released without a specific target (commodity attack). Hence, the targeting of the malicious attack is an important factor when evaluating the severity of an attack.
As described herein, “commodity” attacks are applied indiscriminately against victims and are deployed by the author (malware actor) without requiring his/her further intervention or guidance. In contrast, “premium” attacks are deployed against a specific target (or a set of targets) and exhibit signs of manual operator activity. These attacks may be specially crafted (custom-designed) for use against the target (or set of targets) for a planned purpose. The target (or set of targets) may be a particular electronic device (used by a particular individual) or may be a particular company or industry.
Successful premium attacks may lead to substantial losses such as high value data exfiltration or information technology (IT) infrastructure disruption, and are often launched by nation-states for strategic or military purposes against “high value” targets (e.g., defense contractor, utilities, governmental entity, officers of multi-national companies, etc.). Different types of premium (targeted) attacks may include (i) a zero-day attack that exploits a vulnerability (system or software weakness) before or on the day that the vulnerability is noticed, or (ii) an advanced persistent threat (APT) attack that includes concealed and continuous computer hacking processes, often orchestrated by humans targeting a specific entity. Due to their potential one time or limited use, premium attacks are difficult to detect and frequently escape detection through signature-based approaches. A reliable scheme for classifying premium attacks is needed.